In fig:algadvncfail, we pre-train ResNet50 models using different levels of data augmentation and adversarial training. For data augmentation, we consider RandomCrop, RandomHorizontalFlip, ColorJitter and RandomGrayScale. We add an additional augmentation for each level. I.e., for augmentation level 1, we only do the standardization for samples to make the values have mean 0, variance 1 and don't add any data augmentation, for level 2, we add RandomCrop, for level 3, we add RandomCrop + RandomHorizontalFlip, and etc. For adversarial training, we follow the \(\ell _{\infty }\)  norm bounded adversarial training framework in [1]} with 5 levels of attack size: {\(\frac{1}{255}, \frac{2}{255}, \frac{3}{255}, \frac{5}{255}, \frac{8}{255}\) }.
